Discover a Setting in Windows Registry That Could Affect All Forensic Tools
There is a setting in Windows Registry that affects all the forensic tools, not just smartphones, that can create a discrepancy relating to timestamps on files.
In order to prevent this issue:
- Go to HKEY_CURRENT-USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- Zoom Out and Create a new DWORD (32-bit Value)
- Rename it to “ShowSecondsinSystemClock”
- Change the Value Data to 1
- Restart the forensic workstation
From here, all your tools should now be showing seconds for date/time stamps.
